Lucas Leong

The issue was addressed with improved memory handling. An attacker may be able to cause unexpected system termination or corrupt kernel memory. This flaw allows local attackers to escalate privileges and potentially execute arbitrary code with kernel-level access.

A double free issue was addressed with improved memory management. This issue may allow a remote attacker to cause an unexpected app termination.

This issue allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this issue. The specific flaw exists within the parsing of SMS PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this issue to execute code in the context of the service account.

This issue allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this issue. The specific flaw exists within the parsing of STK command PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this issue to execute code in the context of the service account.

This issue allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this issue. The specific flaw exists within the parsing of STK command PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this issue to execute code in the context of the service account.

This issue allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this issue. The specific flaw exists within the parsing of STK command PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this issue to execute code in the context of the service account.

This issue allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this issue. The specific flaw exists within the parsing of STK command PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this issue to execute code in the context of the service account.

This issue allows network-adjacent attackers to disclose sensitive information via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this issue, as the target must connect to a malicious device. The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root.

This issue allows network-adjacent attackers to disclose sensitive information via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this issue, as the target must connect to a malicious device. The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root.

This issue allows network-adjacent attackers to disclose sensitive information via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this issue, as the target must connect to a malicious device. The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root.

This issue allows network-adjacent attackers to disclose sensitive information on affected installations of BlueZ. User interaction is required to exploit this issue, as the target must connect to a malicious Bluetooth device. The specific flaw exists within the handling of OBEX protocol parameters. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other issues to execute arbitrary code in the context of root.

A flaw was found in the Netfilter subsystem in the Linux kernel. The `sctp mt check` did not validate the `flag count` field. This flaw allows a local privileged (CAP NET ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure.

The issue is related to insufficient access restrictions in the Windows Bluetooth A2DP driver, allowing a remote attacker to exploit the vulnerability and elevate their privileges. This can affect the system, potentially leading to unauthorized access or control.

A flaw was found in the Netfilter subsystem in the Linux kernel. The `nfnl osf add callback` function did not validate the user mode controlled `opt num` field. This flaw allows a local privileged (CAP NET ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure.

A flaw was found in the XFRM subsystem in the Linux kernel, specifically within the processing of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local privileged (CAP NET ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an information disclosure.

This issue allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this issue, where the target must connect to a malicious Bluetooth device. The specific flaw exists within the handling of the Phone Book Access profile, resulting from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this issue to execute code in the context of root.

The issue is related to a heap-based buffer overflow in the Phone Book Access profile of BlueZ, which can be exploited by network-adjacent attackers to execute arbitrary code on affected installations. User interaction is required, as the target must connect to a malicious Bluetooth device. The flaw exists due to the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. This allows an attacker to execute code in the context of root.

The issue is related to a heap-based buffer overflow in the Phone Book Access profile of BlueZ, allowing network-adjacent attackers to execute arbitrary code on affected installations. User interaction is required to exploit this vulnerability, where the target must connect to a malicious Bluetooth device. The flaw exists due to the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer, enabling an attacker to execute code in the context of root.

The issue is related to an out-of-bounds read when setting HMAC data in the SRv6 layer of the Linux kernel. This configuration is realized via netlink through four attributes: `SEG6 ATTR HMACKEYID`, `SEG6 ATTR SECRET`, `SEG6 ATTR SECRETLEN`, and `SEG6 ATTR ALGID`. Because the `SECRETLEN` attribute is decoupled from the actual length of the `SECRET` attribute, it is possible to provide invalid combinations, allowing an out-of-bounds read of up to 64 bytes to occur past the `skb` end pointer and into `skb shared info`. This can be exploited by providing a crafted netlink message. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

The issue is related to an out-of-bounds read vulnerability in the SR-IPv6 implementation in the Linux kernel, specifically within the processing of seg6 attributes. This flaw results from the improper validation of user-supplied data, allowing a read past the end of an allocated buffer. A privileged local user can exploit this to disclose sensitive information on affected installations of the Linux kernel.